/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote99 views1 answer
Run specific logrotate
Shell/Bash
0 vote101 views1 answer
Virtualbox kernel driver not installed ubuntu
Shell/Bash
71 votes97 views6 answers
Kill process at a port ubuntu
Shell/Bash
0 vote101 views1 answer
Cmd NETWORK SERVICE
Shell/Bash
0 vote104 views1 answer
Error running '__rvm_make -j1'
Shell/Bash
0 vote101 views1 answer
Realtek
Shell/Bash
0 vote117 views1 answer
Finda java home
Shell/Bash
1 vote105 views1 answer
Vue js version check
Shell/Bash
-1 vote232 views1 answer
How to comment a whole file in vim?
Shell/Bash
-1 vote96 views1 answer
Ubuntu xampp apache web server running
Shell/Bash